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What is claimed is: 



4' 



10 



15 



20 



A method of producing failure alerts in a computer network containing a 
plurality of netw )rked elements including at least one network router, at least 
one network mai lagement server, and at least one problem management 
server, said rout ;r being interconnected to several subnetworks, each 
subnetwork interconnecting several networked elements, said method 
comprising the steps of: 

monitoring tran ;niisions via a computer network at least one status query 

message to each of said networked elements in said computer network; 

initiating a tim€ r for awaiting receipt of valid status responses from each 
networked element in reply to each status query message; 

performing a fault tree analysis to determine the most likely single point of 
failure based upon a rule structure related to the topology of the 
computjr network, said performance of fault tree analysis being 
invokec by expiration of the timer if less than all status responses are 
received; and 

transmitting via a computer network to said problem management at least one 
elemem; failed message server for said determined single point of 
failure such that said problem management server is notified of the 
most lil:ely point of failure. 



-15- 



J^ll^ Patent Application 

A method of producMg failure alerts in a computer network as set forth in 
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2. 

Claun 1 further comprising the steps of : 
accessing a computer-readable media disposed in said network management 

server to ohpin computer network connectivity and topology data; and 
initiating said rulejstructure based upon said accessed computer network 

connectiviiy and topological data. 

3. A method of producing failure alerts in a computer network as set forth in 
Claim 2, wherein the step of performing fault tree analysis further comprises 
the step of determining that a single element on a subnetwork is failed only if 
no response has/ been received from that single element and other responses 
have been received from other networked element on the same subnetwork 
within a predetermined amount of time. 

4. A method of producing failure alerts in a computer network as set forth in 
Claim 2, wheiein the step of performing fault tree analysis further comprises 
the step of dei ermining that a router interface, network interface card or port is 
failed only if lo responses have been received from any of the networked 
elements on t le subnetwork asssociated with that router interface, network 
interface care or port, and only if other responses have been received from 
other networked elements on other subnetworks associated with other router 
interfaces, network interface cards, and ports on the same router within a 
predetermine 1 amount of time. 
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5. 

Claim 2, wherein the step ^f performing faxilt tree analysis further comprises 
the step of determining thit a router is failed only if no responses have been 
received from any netwoiflced elements on any subnetworks associated with 
any of the router's interfaces, network interface cards, and ports within a 
predetermined amount or time. 

6. A method of producing failure alerts in a computer network as set forth in 
Claim 1, further comprising the steps of: 

receiving via a computer network one or more network element failed 
messages trananitted from said network management server; 

selecting one network element failed message based upon results of said fauh 
tree analysis; /and 

forwarding said selected network element failed messsage to said problem 
management server via a computer network, thereby blocking the 
forwarding/ of all other network element failed messages received from 
the netwonk management server from being received by said problem 
management server. 

7. A method of producing failure alerts in a computer network as set forth in 
Claim 1, futher c omprising the following steps after expiration of the timer 
and prior to perlbrmance of the fault tree analysis: 

immediately retransmitting all status query messages to all networked 
elements upon the expiration of the timer; and 
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re-initiating a timer for awaitingreceipt of valid status responses from 

each networked elemenf in reply to each retransmitted status query 
message, such that saidf step of performing fault tree analysis may be 



performed using a set 
networked elements. 



of recently received responses from the 



A method of producing failurp 
Claim 7 wherein said re-initi; 



alerts in a computer network as set forth in 
Lted timer is set for an expedited expiration, its 
expiration value being significantly shorter than the value of its normally 
initiated value. 

A computer program product for use with network management server in a 
computer network, said computer network containing a plurality of networked 
elements including at least/ one network router, at least one network 
management server, and at least one problem management server, said router 
being interconnected to s( veral subnetworks, each subnetwork interconnecting 
several networked elements, said computer program product comprising: 
a computer usable medimn having computer readable program code means 



embodied in said 



medium for monitoring transmisions via a computer 



network at least one status query message to each of said networked 
elements in said bomputer network; 
a computer xisable medi im having computer readable program code means 
embodied in sai( medium for initiating a timer for awaiting receipt of 
valid status responses from each networked element in reply to each 
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status query message; 



a computer usable medium having computer readable program code means 



embodied in saic 



determine the mc st likely single point of failure based upon a rule 



structure related 
performance of 
timer if less than 



medium for performing a fault tree analysis to 



1 o the topology of the computer network, said 
lult tree analysis being invoked by expiration of the 
all status responses are received; and 



a computer usable medi am having computer readable program code means 
embodied in saijd medium for transmitting via a computer network to 
said problem mfanagement at least one element failed message server 
for said determined single point of failure such that said problem 
management server is notified of the most likely point of failure. 
A computer program/product for use with network management server in a 
computer network as set forth in Claim 9 further comprising: 
a computer usable medium having computer readable program code means 
embodied in said medium for accessing a computer-readable media 
disposed in said network management server to obtain computer 
network connectivity and topology data; and 
a computer usable medium having computer readable program code means 
embodied! in said medixim for initiating said rule structure based upon 
said accessed computer network connectivity and topological data. 
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11. A computer program produdi for use with network management server in a 

computer network as set forth in Claim 9^erein the computer readable code 
for performing fault tree analysis further comprises computer readable 
program code means embodied in said medium for determining that a single 
element on a subnetwork is failed only if no response has been received from 
that single element and ither responses have been received from other 
networked element on l|he same subnetwork withm a predetermined amount of 



12. 



13. 



time. 

A computer program product for use with network management server in a 
computer network as/set forth in Claim ^wherein the computer readable code 
for performing fault tree analysis further comprises computer readable 
program code means embodied in said medium for determining that a router 
interface, network ipterface card or port is failed only if no responses have 



been received from 



any of the networked elements on the subnetwork 



asssociated with that router interface, network interface card or port, and only 
if other responses nave been received from other networked elements on other 
subnetworks associated with other router interfaces, network interface cards, 
and ports on the same router vdthin a predetermined amount of time. 
A computer prog :am product for use with network management server in a 
computer network as set forth in Claim ^/wherein the computer readable code 
for performing fault tree analysis further comprises computer readable 
program code m^ans embodied in said medium for determining that a router is 
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failed only if no responses have been received from any networked elements 
on any subnetworks associated with any of the router's interfaces, network 
interface cards, and ports within a predetermined amount of time. 

14. A computer program prodjuct for use with network management server in a 
computer network as set forth in Clainv^Cfiirther comprising: 

a computer usable medium having computer readable program code means 

embodied in saiii medium for receiving via a computer network one or 
more network felement failed messages transmitted from said network 
management server; 
a computer usable medium having computer readable program code means 
embodied im said medium for selecting one network element failed 
message based upon results of said fault tree analysis; and 
a computer usable medium having computer readable program code means 
embodiea in said medium for forwarding said selected network 
element failed messsage to said problem management server via a 
computer network, thereby blocking the forwarding of all other 
network element failed messages received from the network 
managoment server from being received by said problem 
management server. 

15. A computer pilogram product for use with network management server in a 



computer netv\ork as set forth in Claim 9, fiither comprising: 
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a computer usable medium having computer readable program code means 
embodied in said medium for immediately retransmitting all status 
query messages to allpetworked elements upon the expiration of the 
timer; and 

a computer usable medium lhaving computer readable program code means 
embodied in said mpdium for re-initiating a timer for awaiting receipt 
of valid status responses from each networked element in reply to each 
retransmitted status query message, such that said fault tree analysis 
may be performed using a set of recently received responses from the 
networked elements. 
16. A network management /server system for producing failure alerts in a 

computer network, said /computer network having at least one network router 
interconnected to several subnetworks, a plurality of networked elements 
interconnected via said subnetworks and to said network routers, and at least 
one problem management server for escalation of failure alerts and 
notification of failurefe to maintenance personnel, said network management 
server system comprising: 
a network server including a computer hardware platform with a processor and 
computer-readable medium for storing data and program code, a 
network conmunications protocol stack, a network management 
software sui e, and at least one means for communication to networked 
elements, router and problem management server via said computer 
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network; 

a status monitor which nfionitors status replies from said networked elements 
made in respons^ to status queries from said network management 
software suite; 

a failure analyzer invokfed by said network management software suite upon 
the failure to receive one or more status replies from said networked 
elements, said f lilure analyzer performing fault tree analysis to 

*-iost likely point of failure in the computer network; and 
: t server notifier which transmits a network element 
to the problem management server via a computer 
[ hetwork element failed message including an indicator 
corresponding to said most likely point of failure as determined by the 
failure analyzer. 

17. A network management server system for producing failxire alerts in a 

computer network as set fordi in Claim 16, wherein said failxire analyzer 
further comprises: 

a set of rules for de termining the most likely point of failure based upon a 
predetermiied topological interrelationship between the networked 
elements, Ihe subnetworks, and the routers and their interfaces to the 
subnetworks; and 

a comparator which applies the rules to a set of information containing all the 
status replies received from networked elements within a 



determine the ijn 
a problem managemei 
failed message 
network, said 



\ 
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predetermined time peri6d, said comparator producing an output 
corresponding to a most likely point of failure of the network. 

18. A network management servfer system for producing failure alerts in a 
computer network as set forth in Claim 17, wherein said set of rules comprise 
a rule that declares a netwdrked element to be failed only if no status reply 
from the networked elemeJit is found m the set of information being analyzed 
by the analyzer, and only if at least one status reply from any other networked 
element on the same subnetwork is found in the set of information being 
analyzed by the anal) 

19. A network management server system for producing failure alerts in a 
computer network as feet forth in Claim 17, wherein said set of rules comprise 
a rule that declares a suspect network router interface, network interface card, 
and port to be failed lonly if no status reply from any networked element on the 
subnetwork associalted with the suspect network router interface, network 
interface card, and port is found in the set of information being analyzed by 
the analyzer, and oiily if at least one status reply from any other networked 
element on any other subnetwork associated with any other router interface, 
network interface < ;ard, and port on the same network router is found in the set 
of information beiag analyzed by the analyzer. 

20. A network management server system for producing failure alerts in a 
computer network as set forth in Claim 17, wherein said set of rules comprise 
a rule that declares a suspect network router to be failed only if no status reply 
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from any networked element iny subnetwork associated any network interface 
card or port associated withAhe suspect network is found in the set of 
information being analyzed by the analyzer. 

21. A network management sefrver system for producing failure alerts in a 
computer network as set forth in Claim 16 further comprising a status 
refresher which immediately transmits a status query message to each 
networked element upon the invocation of the failure analyzer in order to 
update the set of replifes received and allow analysis on more recent status of 
the network to be performed. 

22. A network manageiAent server system for producing failure alerts in a 
computer network as set forth in Claim 16 wherein said status monitor, fault 
analyzer and problem management server notifier are application programs 
interfaced to a standard network management server software suite. 

23. A network management server system for producing failxire alerts in a 
computer netwodc as set forth in Claim 22 wherein said application programs 
are "C" progranis compiled and targeted for execution by said computer 
hardware platform. 

24. A network mai agement server system for producing failure alerts in a 
computer network as set forth in Claim 22 wherein said standard network 
management s jrver software suite is a NetView suite. 



-25- 



AUS990892L^||^ ^^Patent Application 

25 . A network managemem server system for producing failure alerts in a 
computer network as set forth in Claim 22 wherein said standard network 
management server software suite is an OpenView suite. 

26. A network management server system for producing failxire alerts in a 
computer network a 3 set forth in Claim 22 wherein said computer hardware 
platform is an RS/fijoOO computer platform running an AIX operating system, 
both of which are Iitemational Business Machines products. 
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